11import { spawnSync } from "node:child_process";
2-import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
2+import {
3+chmodSync,
4+existsSync,
5+mkdirSync,
6+mkdtempSync,
7+readFileSync,
8+readdirSync,
9+rmSync,
10+writeFileSync,
11+} from "node:fs";
312import { tmpdir } from "node:os";
413import path from "node:path";
514import { afterEach, describe, expect, it } from "vitest";
@@ -28,6 +37,50 @@ function runCodesign(args: string[], tempRoot: string) {
2837});
2938}
303940+function installFakeCodesign(binDir: string) {
41+const fakeCodesign = path.join(binDir, "codesign");
42+writeFileSync(
43+fakeCodesign,
44+`#!/usr/bin/env bash
45+set -euo pipefail
46+47+entitlements=""
48+target=""
49+while [ "$#" -gt 0 ]; do
50+ case "$1" in
51+ --entitlements)
52+ shift
53+ entitlements="$1"
54+ ;;
55+ esac
56+ target="$1"
57+ shift || true
58+done
59+60+if [ -z "$target" ]; then
61+ echo "missing codesign target" >&2
62+ exit 2
63+fi
64+65+if [ -n "$entitlements" ]; then
66+ count_file="$CODESIGN_CAPTURE_DIR/count"
67+ count=0
68+ if [ -f "$count_file" ]; then
69+ count="$(cat "$count_file")"
70+ fi
71+ count=$((count + 1))
72+ printf '%s' "$count" >"$count_file"
73+ copy="$CODESIGN_CAPTURE_DIR/entitlements-$count.plist"
74+ cp "$entitlements" "$copy"
75+ printf 'entitled\\t%s\\t%s\\t%s\\n' "$target" "$entitlements" "$copy" >>"$CODESIGN_LOG"
76+else
77+ printf 'plain\\t%s\\n' "$target" >>"$CODESIGN_LOG"
78+fi
79+`,
80+);
81+chmodSync(fakeCodesign, 0o755);
82+}
83+3184afterEach(() => {
3285for (const dir of tempDirs.splice(0)) {
3386rmSync(dir, { recursive: true, force: true });
@@ -82,4 +135,48 @@ describe("codesign-mac-app temp file hygiene", () => {
82135expect(result.status).not.toBe(0);
83136expect(entitlementTemps(tempRoot)).toEqual([]);
84137});
138+139+it("passes generated app entitlements to signing commands and cleans them", () => {
140+const tempRoot = makeTempDir("openclaw-codesign-success-");
141+const app = path.join(tempRoot, "Fake.app");
142+const binDir = path.join(tempRoot, "bin");
143+const captureDir = path.join(tempRoot, "capture");
144+const logPath = path.join(captureDir, "codesign.log");
145+mkdirSync(path.join(app, "Contents", "MacOS"), { recursive: true });
146+mkdirSync(binDir);
147+mkdirSync(captureDir);
148+writeFileSync(path.join(app, "Contents", "MacOS", "OpenClaw"), "#!/bin/sh\n");
149+installFakeCodesign(binDir);
150+151+const result = spawnSync("bash", [scriptPath, app], {
152+cwd: process.cwd(),
153+encoding: "utf8",
154+env: {
155+ ...process.env,
156+CODESIGN_CAPTURE_DIR: captureDir,
157+CODESIGN_LOG: logPath,
158+PATH: `${binDir}${path.delimiter}${process.env.PATH ?? ""}`,
159+SIGN_IDENTITY: "-",
160+SKIP_TEAM_ID_CHECK: "1",
161+TMPDIR: tempRoot,
162+},
163+});
164+165+expect(result.status).toBe(0);
166+expect(result.stdout).toContain(`Codesign complete for ${app}`);
167+168+const signLines = readFileSync(logPath, "utf8").trim().split("\n");
169+expect(signLines).toHaveLength(2);
170+expect(signLines[0]).toContain(`${path.join(app, "Contents", "MacOS", "OpenClaw")}\t`);
171+expect(signLines[1]).toContain(`${app}\t`);
172+for (const line of signLines) {
173+const [, , entitlementPath, copiedEntitlementsPath] = line.split("\t");
174+const copiedEntitlements = readFileSync(copiedEntitlementsPath, "utf8");
175+expect(entitlementPath).toContain("openclaw-entitlements");
176+expect(existsSync(entitlementPath)).toBe(false);
177+expect(copiedEntitlements).toContain("com.apple.security.automation.apple-events");
178+expect(copiedEntitlements).toContain("com.apple.security.device.camera");
179+}
180+expect(entitlementTemps(tempRoot)).toEqual([]);
181+});
85182});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。